49ers sued by Atlanta Falcons employee over Super Bowl week data breach


An employee of the NFL’s Atlanta Falcons sued the San Francisco 49ers on Friday in federal court, saying the team exposed her social security number and other personal information in a data breach and then failed to adequately notify her and more than 20,000 other potential victims for months. The plaintiff, Samantha Donelson, said in her lawsuit that she got caught up in the breach — the result of an attack by a ransomware gang — because the 49ers store personal information on "employees, vendors, and other business partners. This information, including names, dates of birth, and Social Security Numbers, was stored on the 49ers internal corporate IT systems." It’s unclear who else was victimized within the 49ers or other NFL teams. The team first said in February that ransomware attackers had accessed its systems and encrypted its files. Officials said then the breach was limited to the 49ers’ "corporate network" and did not extend to ticket buyers. The attackers did not make their ransom demands public or say how much data they had stolen. At the time, the 49ers’ season was over, after they lost to the Los Angeles Rams in the NFC Championship Game. The team said then that it rushed to cut off the access and enlisted a cybersecurity firm to investigate. Last week, the 49ers said in a government notification that the attack affected 20,930 individuals who may have been victimized by identity theft. The team also sent breach notification letters to people whose information may have been stolen. A probe completed in August, the team said, revealed that unauthorized access to files had happened during the week of Feb. 6-11. "We have begun notifying individuals whose data may have been compromised during a cybersecurity incident on our corporate network earlier this year and are offering complimentary credit monitoring and identity theft protection services to them," Jacob Fill, a 49ers spokesperson, told The Chronicle. The 49ers did not respond to The Chronicle’s request for comment Friday on Donelson’s lawsuit. Donelson, an Atlanta resident who works in the Falcons’ live events department, filed suit in the U.S. District Court in San Jose. She seeks unspecified damages and class-action status for other alleged victims. The 49ers have not formally responded to the suit in court. Donelson provided her information to the 49ers "as part of her work for the Falcons," according to the suit, and "trusted the company would use reasonable measures to protect it."